Buggy code:
private void resetPredictState ( PredictorState ps ) { } private void resetAllPredictors ( PredictorState [ ] ps ) { } private void resetPredictorGroup ( PredictorState [ ] ps , int groupNum ) { } private static float flt16Round ( float pf ) { } private static float flt16Even ( float pf ) { } private static float flt16Trunc ( float pf ) { } private void predict ( PredictorState ps , float [ ] coef , int coefOffset , boolean outputEnable ) { } private void applyPrediction ( SingleChannelElement sce ) { } private int decodeIcs ( SingleChannelElement sce , boolean commonWindow , boolean scaleFlag ) { } private void decodeChannelMap ( int [ ] [ ] layoutMap , int layoutMapOffset , int type , int n ) { } private int decodePce ( MPEG4AudioConfig m4ac , int [ ] [ ] layoutMap ) { } private void pushOutputConfiguration ( ) { } private void popOutputConfiguration ( ) { } private int assignPair ( AacDecoder . ElemToChannel [ ] e2cVec , int [ ] [ ] layoutMap , int offset , int left , int right , int pos ) { } private int countPairedChannels ( int [ ] [ ] layoutMap , int tags , int pos , int [ ] current ) { } private int sniffChannelOrder ( int [ ] [ ] layoutMap , int tags ) { } private int cheConfigure ( int chePos , int type , int id , int [ ] channels ) { } private int outputConfigure ( int [ ] [ ] layoutMap , int tags , int ocType , boolean getNewFrame ) { } private int decodeCpe ( ChannelElement cpe ) { } private void decodeMidSideStereo ( ChannelElement cpe , int msPresent ) { } private void applyMidSideStereo ( ChannelElement cpe ) { } private void applyIntensityStereo ( ChannelElement cpe , int msPresent ) { } private int decodeCce ( ChannelElement che ) { } private int skipDataStreamElement ( ) { } private int decodeDrcChannelExclusions ( DynamicRangeControl cheDrc ) { } private int decodeDynamicRange ( DynamicRangeControl cheDrc ) { } private int decodeFill ( int len ) { } private int decodeExtensionPayload ( int cnt , ChannelElement che , int elemType ) { boolean crcFlag = false ; int res = cnt ; switch ( br . read ( 4 ) ) { case AacDecoder . EXT_SBR_DATA_CRC : crcFlag = true ; case AacDecoder . EXT_SBR_DATA : if ( che == null ) { AacDecoder . log . error ( String . format ( "SBR<seq2seq4repair_space>was<seq2seq4repair_space>found<seq2seq4repair_space>before<seq2seq4repair_space>the<seq2seq4repair_space>first<seq2seq4repair_space>channel<seq2seq4repair_space>element" ) ) ; return res ; } else if ( ( ac . oc [ 1 ] . m4ac . sbr ) == 0 ) { AacDecoder . log . error ( String . format ( "SBR<seq2seq4repair_space>signaled<seq2seq4repair_space>to<seq2seq4repair_space>be<seq2seq4repair_space>not-present<seq2seq4repair_space>but<seq2seq4repair_space>was<seq2seq4repair_space>found<seq2seq4repair_space>in<seq2seq4repair_space>the<seq2seq4repair_space>bitstream" ) ) ; br . skip ( ( ( 8 * cnt ) - 4 ) ) ; return res ; } else if ( ( ( ac . oc [ 1 ] . m4ac . sbr ) == ( - 1 ) ) && ( ( ac . oc [ 1 ] . status ) == ( OutputConfiguration . OC_LOCKED ) ) ) { AacDecoder . log . error ( String . format ( "Implicit<seq2seq4repair_space>SBR<seq2seq4repair_space>was<seq2seq4repair_space>found<seq2seq4repair_space>with<seq2seq4repair_space>a<seq2seq4repair_space>first<seq2seq4repair_space>occurrence<seq2seq4repair_space>after<seq2seq4repair_space>the<seq2seq4repair_space>first<seq2seq4repair_space>frame" ) ) ; br . skip ( ( ( 8 * cnt ) - 4 ) ) ; return res ; } else if ( ( ( ( ac . oc [ 1 ] . m4ac . ps ) == ( - 1 ) ) && ( ( ac . oc [ 1 ] . status ) < ( OutputConfiguration . OC_LOCKED ) ) ) && ( ( ac . channels ) == 1 ) ) { ac . oc [ 1 ] . m4ac . sbr = 1 ; ac . oc [ 1 ] . m4ac . ps = 1 ; outputConfigure ( ac . oc [ 1 ] . layoutMap , ac . oc [ 1 ] . layoutMapTags , ac . oc [ 1 ] . status , true ) ; } else { ac . oc [ 1 ] . m4ac . sbr = 1 ; } res = AacSbr . decodeSbrExtension ( ac , che . sbr , crcFlag , cnt , elemType ) ; break ; case AacDecoder . EXT_DYNAMIC_RANGE : res = decodeDynamicRange ( ac . cheDrc ) ; break ; case AacDecoder . EXT_FILL : <START_BUG> res = decodeFill ( ( ( 8 * cnt ) - 4 ) ) ; <END_BUG> break ; case AacDecoder . EXT_FILL_DATA : case AacDecoder . EXT_DATA_ELEMENT : default : br . skip ( ( ( 8 * cnt ) - 4 ) ) ; break ; } return res ; } private void imdctAndWindowing ( SingleChannelElement sce ) { } private void imdctAndWindowingLd ( SingleChannelElement sce ) { } private void imdctAndWindowingEld ( SingleChannelElement sce ) { } private void imdctAndWindow ( SingleChannelElement sce ) { } private void windowingAndMdctLtp ( float [ ] out , float [ ] in , IndividualChannelStream ics ) { } private void applyLtp ( SingleChannelElement sce ) { } private void updateLtp ( SingleChannelElement sce ) { } private void applyTns ( float [ ] coef , TemporalNoiseShaping tns , IndividualChannelStream ics , boolean decode ) { } private void applyDependentCoupling ( SingleChannelElement target , ChannelElement cce , int index ) { } private void applyIndependentCoupling ( SingleChannelElement target , ChannelElement cce , int index ) { } private void applyCouplingMethod ( SingleChannelElement target , ChannelElement cce , int index , boolean applyDependentCoupling ) { } private void applyChannelCoupling ( ChannelElement cc , int type , int elemId , int couplingPoint , boolean applyDependentCoupling ) { } private void spectralToSample ( ) { } private int decodeFrameInt ( ) { } private int decodeErFrame ( ) { } @ Override public int decode ( int inputAddr , int inputLength , int outputAddr ) { } @ Override public int getNumberOfSamples ( ) { } }

Fix:
decodeFill ( ( ( 8 * cnt ) - 4 ) ) ;